Spyware / Malware / Virus Removal

[Closed] my hijack this log

10 min read

Looking for the outcome? Ask AI

gizmo161uk Topic Starter

Post #1January 20, 2008, 12:22 PM UTC last edited January 20, 2008, 2:04 PM UTC

I'm coming close to throwing my laptop out of the window, can anyone please help me… All scans show nothing, but i keep getting threat notifications of Bobic worm and Generic 9, Backdoor generic 4. I've looked on the net for things to remove them but have had no luck. Laptop is running so slow, to do everything, and the threats keep coming up all the time, Also after every reboot programs are being removed i think, because they won't open unless I re install them. Log file is below
Thank you in advance

—————————————————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:16:39, on 20/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {EE943425-6FF2-4725-8A8A-20B41332F73F} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: urqnmji - urqnmji.dll (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 9186 bytes

ken545

Post #2January 30, 2008, 12:00 AM UTC

gizmo161uk,

Welcome to the forum, sorry for the delay. We get so busy in these forums with infected computers that sometimes its hard to keep up. It looks like you may be infected with the Vundo Trojan, lets do a few things.

Download VundoFix to your desktop

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

I need to see the Vundofix log, the Combofix log and a New HJT log please

gizmo161uk

Post #3January 30, 2008, 7:39 PM UTC last edited January 30, 2008, 7:41 PM UTC

Thanks so much for getting back to me, here are the requested log files.

================================================================================

VundoFix

VundoFix V6.7.7

Checking Java version…

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 17:43:06 30/01/2008

Listing files found while scanning….

No infected files were found.

Beginning removal…

================================================================================

ComboFix

ComboFix 08-01-30.6 - User 2008-01-30 18:53:26.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
ADS - system32: deleted 1087273 bytes in 2 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ghhkj.ini
C:\WINDOWS\system32\ghhkj.ini2
C:\WINDOWS\system32\srutv.ini
C:\WINDOWS\system32\srutv.ini2

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-30 )))))))))))))))))))))))))))))))
.

2008-01-30 17:43 . 2008-01-30 17:43 d——– C:\VundoFix Backups
2008-01-28 10:21 . 2008-01-28 10:21 7,680 –ahs—- C:\WINDOWS\Thumbs.db
2008-01-27 01:44 . 2008-01-27 01:44 d——– C:\Documents and Settings\User\Application Data\Jasc Software Inc
2008-01-26 18:07 . 2008-01-26 18:45 d——– C:\Program Files\The Weather Channel FW
2008-01-26 18:07 . 2008-01-26 18:07 d——– C:\Program Files\AskPBar
2008-01-26 18:04 . 2008-01-26 18:17 d——– C:\Program Files\Trillian
2008-01-26 06:06 . 2008-01-26 06:06 d——– C:\Documents and Settings\User\Application Data\Sonic
2008-01-25 19:37 . 2008-01-25 19:37 d——– C:\Documents and Settings\User\Application Data\Ulead Systems
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\WINDOWS\system32\ws073247.ocx
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\os357577.bin
2008-01-25 19:35 . 2008-01-25 19:35 d——– C:\WINDOWS\Vbox
2008-01-25 19:34 . 2008-01-25 19:34 d——– C:\Program Files\Ulead Systems
2008-01-25 19:34 . 2008-01-25 19:36 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-01-25 19:33 . 2008-01-25 19:33 d——– C:\WINDOWS\Noslip
2008-01-20 11:50 . 2005-01-31 10:04 2,180,096 –a—— C:\WINDOWS\system32\drivers\lvsvf2.sys
2008-01-19 07:34 . 2008-01-30 19:01 11,434,016 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-19 07:34 . 2008-01-30 19:01 118,916 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-18 22:38 . 2008-01-26 05:56 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 22:36 . 2008-01-24 09:14 d——– C:\Program Files\Spyware Doctor
2008-01-18 22:36 . 2008-01-18 22:36 d——– C:\Documents and Settings\User\Application Data\PC Tools
2008-01-18 22:36 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-18 22:36 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-18 22:36 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-18 22:36 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 22:35 . 2008-01-18 22:35 d——– C:\Program Files\ZoneAlarmSB
2008-01-18 22:29 . 2008-01-18 22:29 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-18 22:28 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-18 22:28 . 2008-01-18 22:36 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-01-18 22:27 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-01-18 22:23 . 2008-01-18 22:28 d——– C:\WINDOWS\system32\ZoneLabs
2008-01-18 22:23 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-01-18 22:23 . 2008-01-30 19:02 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-01-18 22:21 . 2008-01-30 18:31 d——– C:\WINDOWS\Internet Logs
2008-01-18 22:16 . 2008-01-30 17:32 d——– C:\Documents and Settings\User\Application Data\AVG7
2008-01-18 22:15 . 2008-01-18 22:15 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-18 22:14 . 2008-01-18 22:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-18 20:17 . 2008-01-18 20:23 d——– C:\Program Files\RegistryFix
2008-01-18 13:40 . 2008-01-18 13:40 d——– C:\Documents and Settings\User\Application Data\Grisoft
2008-01-18 13:39 . 2007-05-30 12:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-18 10:59 . 2008-01-18 10:59 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-18 10:58 . 2008-01-18 17:38 d——– C:\Program Files\The Cleaner Free
2008-01-17 14:23 . 2002-03-13 08:50 23,296 –a—— C:\WINDOWS\system32\drivers\NaiFiltr.sys
2008-01-17 13:40 . 2005-08-10 11:22 114,464 –a—— C:\WINDOWS\system32\drivers\naiavf5x.sys
2008-01-17 13:38 . 2008-01-17 13:42 d——– C:\Documents and Settings\All Users\Application Data\MCAD3.tmp
2008-01-17 13:03 . 2008-01-17 13:34 d——– C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-01-17 13:02 . 2005-05-24 19:23 288,320 –a—— C:\WINDOWS\system32\McGDMgr.dll
2008-01-17 13:01 . 2008-01-17 13:04 d——– C:\Program Files\McAfee.com
2008-01-17 13:01 . 2005-10-18 11:08 349,760 –a—— C:\WINDOWS\system32\mcinsctl.dll
2008-01-17 12:41 . 2008-01-17 12:41 d——– C:\Documents and Settings\All Users\Application Data\pcgdemo
2008-01-17 10:43 . 2008-01-18 22:14 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 03:00 . 2008-01-17 03:00 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-17 02:57 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2008-01-17 02:56 . 2005-01-31 10:18 372,736 –a—— C:\WINDOWS\system32\LVUI2RC.dll
2008-01-17 02:56 . 2005-01-31 10:20 211,712 –a—— C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-01-17 02:56 . 2005-01-31 10:10 204,800 –a—— C:\WINDOWS\system32\LVUI2.dll
2008-01-17 02:56 . 2005-01-31 10:08 204,800 –a—— C:\WINDOWS\system32\lvcodec2.dll
2008-01-17 02:56 . 2005-01-31 10:00 106,496 –a—— C:\WINDOWS\system32\lvcoinst.dll
2008-01-17 02:56 . 2005-01-31 10:12 22,016 –a—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-01-17 02:56 . 2005-01-31 08:37 9,255 –a—— C:\WINDOWS\system32\lvcoinst.ini
2008-01-17 02:54 . 2008-01-20 11:40 512 –a—— C:\WINDOWS\_delis32.ini
2008-01-17 02:49 . 2008-01-17 02:49 81,920 -r——- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-16 12:53 . 2008-01-18 17:54 d——– C:\Program Files\MSN Messenger
2008-01-16 12:37 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-16 12:37 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-16 12:37 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 08:16 . 2008-01-16 08:25 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-16 08:15 . 2008-01-18 17:52 d——– C:\Program Files\Windows Live
2008-01-16 08:14 . 2008-01-17 10:52 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a–c— C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a–c— C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a–c— C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2008-01-13 04:01 . 2008-01-17 02:56 d——– C:\Program Files\Common Files\Logitech
2008-01-13 03:59 . 2008-01-17 02:31 d——– C:\Program Files\Common Files\LogiShrd
2008-01-13 03:57 . 2008-01-17 02:49 d——– C:\Program Files\Logitech
2008-01-11 21:55 . 2004-05-14 16:53 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2008-01-11 21:55 . 2004-01-12 02:09 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2008-01-11 21:55 . 2003-11-04 15:10 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2008-01-10 17:43 . 2006-11-22 21:11 135,168 -ra—— C:\WINDOWS\UNDPX2A.exe
2008-01-10 17:43 . 2006-11-22 21:11 53,693 -ra—— C:\WINDOWS\UNDPX2A.sys
2008-01-10 17:43 . 2006-11-22 21:11 15,429 -ra—— C:\WINDOWS\system32\drivers\Sacm2A.sys
2007-12-18 16:56 . 2007-12-18 16:56 268 –ah—– C:\sqmdata07.sqm
2007-12-18 16:56 . 2007-12-18 16:56 244 –ah—– C:\sqmnoopt07.sqm
2007-12-01 17:55 . 2007-12-01 17:55 d——– C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 01:44 ——— d—–w C:\Program Files\Jasc Software Inc
2008-01-26 12:45 ——— d—–w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-01-25 19:34 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 11:26 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-19 10:32 ——— d—–w C:\Program Files\Ares
2008-01-16 03:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 09:07 ——— d—–w C:\Program Files\Plugin Commander Light
2007-10-22 06:01 56 –sha-r C:\WINDOWS\system32\36375C4983.sys
2007-10-22 06:01 1,682 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

—-a-w		   579,072 2008-01-17 09:58:16  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   219,136 2008-01-17 10:03:04  C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w		 5,674,352 2008-01-17 09:58:46  C:\Program Files\MSN Messenger\MsnMsgr .Exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE943425-6FF2-4725-8A8A-20B41332F73F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-18 22:36 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BA52B914-B692-46C4-B683-905236F6F655}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}
{F4D76F09-7896-458A-890F-E1F05C46069F}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-18 22:36 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 21:54 961536]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPSMain"="TPSMain.exe" [2006-02-08 14:02 266240 C:\WINDOWS\system32\TPSMain.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-20 11:23 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-18 22:14 219136]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnmji]
urqnmji.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F062886D-33B5-D25E-7167-F0D10E66C0D5}]
C:\WINDOWS\system32:dllhosts.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 19:03:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-01-30 19:23:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-30 19:23:19
.
2008-01-20 11:26:50 — E O F —

================================================================================

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:35:39, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {EE943425-6FF2-4725-8A8A-20B41332F73F} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: urqnmji - urqnmji.dll (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8943 bytes

ken545

Post #4January 31, 2008, 12:31 AM UTC

Hello,

First thing I would do is uninstall AskPBar as this targets kids with adds and is not needed, you can remove it via the Add Remove Programs in the Control Panel.

Your infected with the latest variant of the Vundo Trojan that is a File Infector, what this trojan has done is infected some legitimate programs on your system . If you look at your Combofix log , the programs in the BLUE CODE BOX are infected, it looks like we may have caught it early because I am only looking at three programs and I have worked logs where dozens of programs have been infected. This is what we need to do.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\_delis32.ini

Folder::
C:\Program Files\AskPBar

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE943425-6FF2-4725-8A8A-20B41332F73F}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnmji]

RenV::
—-a-w 579,072 2008-01-17 09:58:16 C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w 219,136 2008-01-17 10:03:04 C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w 5,674,352 2008-01-17 09:58:46 C:\Program Files\MSN Messenger\MsnMsgr .Exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

gizmo161uk

Post #5January 31, 2008, 1:09 PM UTC

Here are the requested logs

Combo Fix

ComboFix 08-01-30.6 - User 2008-01-31 2:31:11.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\_delis32.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AskPBar
C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
C:\Program Files\AskPBar\bar\History\search2
C:\WINDOWS\_delis32.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))
.

2008-01-31 02:22 . 2008-01-26 18:07 241,664 –a—— C:\Program Files\Uninstall Ask Toolbar.dll
2008-01-30 17:43 . 2008-01-30 17:43 d——– C:\VundoFix Backups
2008-01-28 10:21 . 2008-01-28 10:21 7,680 –ahs—- C:\WINDOWS\Thumbs.db
2008-01-27 01:44 . 2008-01-27 01:44 d——– C:\Documents and Settings\User\Application Data\Jasc Software Inc
2008-01-26 18:07 . 2008-01-26 18:45 d——– C:\Program Files\The Weather Channel FW
2008-01-26 18:04 . 2008-01-26 18:17 d——– C:\Program Files\Trillian
2008-01-26 06:06 . 2008-01-26 06:06 d——– C:\Documents and Settings\User\Application Data\Sonic
2008-01-25 19:37 . 2008-01-25 19:37 d——– C:\Documents and Settings\User\Application Data\Ulead Systems
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\WINDOWS\system32\ws073247.ocx
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\os357577.bin
2008-01-25 19:35 . 2008-01-25 19:35 d——– C:\WINDOWS\Vbox
2008-01-25 19:34 . 2008-01-25 19:34 d——– C:\Program Files\Ulead Systems
2008-01-25 19:34 . 2008-01-25 19:36 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-01-25 19:33 . 2008-01-25 19:33 d——– C:\WINDOWS\Noslip
2008-01-20 11:50 . 2005-01-31 10:04 2,180,096 –a—— C:\WINDOWS\system32\drivers\lvsvf2.sys
2008-01-19 07:34 . 2008-01-30 19:01 11,434,016 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-19 07:34 . 2008-01-30 19:01 118,916 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-18 22:38 . 2008-01-26 05:56 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 22:36 . 2008-01-24 09:14 d——– C:\Program Files\Spyware Doctor
2008-01-18 22:36 . 2008-01-18 22:36 d——– C:\Documents and Settings\User\Application Data\PC Tools
2008-01-18 22:36 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-18 22:36 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-18 22:36 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-18 22:36 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 22:35 . 2008-01-18 22:35 d——– C:\Program Files\ZoneAlarmSB
2008-01-18 22:29 . 2008-01-18 22:29 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-18 22:28 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-18 22:28 . 2008-01-18 22:36 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-01-18 22:27 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-01-18 22:23 . 2008-01-18 22:28 d——– C:\WINDOWS\system32\ZoneLabs
2008-01-18 22:23 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-01-18 22:23 . 2008-01-30 19:05 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-01-18 22:21 . 2008-01-31 02:23 d——– C:\WINDOWS\Internet Logs
2008-01-18 22:16 . 2008-01-30 17:32 d——– C:\Documents and Settings\User\Application Data\AVG7
2008-01-18 22:15 . 2008-01-18 22:15 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-18 22:14 . 2008-01-18 22:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-18 20:17 . 2008-01-18 20:23 d——– C:\Program Files\RegistryFix
2008-01-18 13:40 . 2008-01-18 13:40 d——– C:\Documents and Settings\User\Application Data\Grisoft
2008-01-18 13:39 . 2007-05-30 12:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-18 10:59 . 2008-01-18 10:59 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-18 10:58 . 2008-01-18 17:38 d——– C:\Program Files\The Cleaner Free
2008-01-17 14:23 . 2002-03-13 08:50 23,296 –a—— C:\WINDOWS\system32\drivers\NaiFiltr.sys
2008-01-17 13:40 . 2005-08-10 11:22 114,464 –a—— C:\WINDOWS\system32\drivers\naiavf5x.sys
2008-01-17 13:38 . 2008-01-17 13:42 d——– C:\Documents and Settings\All Users\Application Data\MCAD3.tmp
2008-01-17 13:03 . 2008-01-17 13:34 d——– C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-01-17 13:02 . 2005-05-24 19:23 288,320 –a—— C:\WINDOWS\system32\McGDMgr.dll
2008-01-17 13:01 . 2008-01-17 13:04 d——– C:\Program Files\McAfee.com
2008-01-17 13:01 . 2005-10-18 11:08 349,760 –a—— C:\WINDOWS\system32\mcinsctl.dll
2008-01-17 12:41 . 2008-01-17 12:41 d——– C:\Documents and Settings\All Users\Application Data\pcgdemo
2008-01-17 10:43 . 2008-01-18 22:14 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 03:00 . 2008-01-17 03:00 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-17 02:57 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2008-01-17 02:56 . 2005-01-31 10:18 372,736 –a—— C:\WINDOWS\system32\LVUI2RC.dll
2008-01-17 02:56 . 2005-01-31 10:20 211,712 –a—— C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-01-17 02:56 . 2005-01-31 10:10 204,800 –a—— C:\WINDOWS\system32\LVUI2.dll
2008-01-17 02:56 . 2005-01-31 10:08 204,800 –a—— C:\WINDOWS\system32\lvcodec2.dll
2008-01-17 02:56 . 2005-01-31 10:00 106,496 –a—— C:\WINDOWS\system32\lvcoinst.dll
2008-01-17 02:56 . 2005-01-31 10:12 22,016 –a—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-01-17 02:56 . 2005-01-31 08:37 9,255 –a—— C:\WINDOWS\system32\lvcoinst.ini
2008-01-17 02:49 . 2008-01-17 02:49 81,920 -r——- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-16 12:53 . 2008-01-18 17:54 d——– C:\Program Files\MSN Messenger
2008-01-16 12:37 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-16 12:37 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-16 12:37 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 08:16 . 2008-01-16 08:25 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-16 08:15 . 2008-01-18 17:52 d——– C:\Program Files\Windows Live
2008-01-16 08:14 . 2008-01-17 10:52 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a–c— C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a–c— C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a–c— C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2008-01-13 04:01 . 2008-01-17 02:56 d——– C:\Program Files\Common Files\Logitech
2008-01-13 03:59 . 2008-01-17 02:31 d——– C:\Program Files\Common Files\LogiShrd
2008-01-13 03:57 . 2008-01-17 02:49 d——– C:\Program Files\Logitech
2008-01-11 21:55 . 2004-05-14 16:53 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2008-01-11 21:55 . 2004-01-12 02:09 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2008-01-11 21:55 . 2003-11-04 15:10 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2008-01-10 17:43 . 2006-11-22 21:11 135,168 -ra—— C:\WINDOWS\UNDPX2A.exe
2008-01-10 17:43 . 2006-11-22 21:11 53,693 -ra—— C:\WINDOWS\UNDPX2A.sys
2008-01-10 17:43 . 2006-11-22 21:11 15,429 -ra—— C:\WINDOWS\system32\drivers\Sacm2A.sys
2007-12-18 16:56 . 2007-12-18 16:56 268 –ah—– C:\sqmdata07.sqm
2007-12-18 16:56 . 2007-12-18 16:56 244 –ah—– C:\sqmnoopt07.sqm
2007-12-01 17:55 . 2007-12-01 17:55 d——– C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 09:23 3,417,600 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-29 09:22 1,411,072 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 01:44 ——— d—–w C:\Program Files\Jasc Software Inc
2008-01-26 12:45 ——— d—–w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-01-25 19:34 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 11:26 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-19 10:32 ——— d—–w C:\Program Files\Ares
2008-01-16 03:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 09:07 ——— d—–w C:\Program Files\Plugin Commander Light
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-22 06:02 36,734 —-a-w C:\WINDOWS\system32\OggDSuninst.exe
2007-10-22 06:02 33,533 —-a-w C:\WINDOWS\system32\CoreVorbis-uninstall.exe
2007-10-11 05:57 666,112 —-a-w C:\WINDOWS\system32\wininet.dll
2007-10-22 06:01 56 –sha-r C:\WINDOWS\system32\36375C4983.sys
2007-10-22 06:01 1,682 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

—-a-w		   579,072 2008-01-17 09:58:16  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   219,136 2008-01-17 10:03:04  C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w		 5,674,352 2008-01-17 09:58:46  C:\Program Files\MSN Messenger\MsnMsgr .Exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-18 22:36 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BA52B914-B692-46C4-B683-905236F6F655}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-18 22:36 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 21:54 961536]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPSMain"="TPSMain.exe" [2006-02-08 14:02 266240 C:\WINDOWS\system32\TPSMain.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-20 11:23 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AskPBar Uninstall"="C:\PROGRA~1\UNINST~1.DLL" [2008-01-26 18:07 241664]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-18 22:14 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F062886D-33B5-D25E-7167-F0D10E66C0D5}]
C:\WINDOWS\system32:dllhosts.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 02:35:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-31 3:28:47
ComboFix-quarantined-files.txt 2008-01-31 03:28:40
ComboFix2.txt 2008-01-30 19:23:34
.
2008-01-20 11:26:50 — E O F —

================================================================================

Hi Jack This

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:30:01, on 31/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\RunOnce: [AskPBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -2
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8495 bytes

ken545

Post #6January 31, 2008, 5:33 PM UTC

Please download OTMoveIt by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Grisoft\AVG7\avgcc .exe
C:\Program Files\Grisoft\AVG7\avgw .exe
C:\Program Files\MSN Messenger\MsnMsgr .Exe
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Drag Combofix to the trash and grab a fresh copy as its updated on a regualar basis.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

I need to see the OtMoveIt Log, the New Combofix log and a new HJT log please

gizmo161uk

Post #7February 2, 2008, 4:05 AM UTC

Hi I can't download the OTMoveit, the link you gave me is taking me to a 404 error page, is their somewhere else I can download this from? I appologise for my late reply, i'm 6 and a half months pregnant and have been put on bed rest so at the moment I can only be at the laptop for a short time, each time i use it. I'm trying to do everything within a reasonable amount of time though. Once you can give me another link for the OTMoveit, I will download it and get the latest requested logs for you Laura

ken545

Post #8February 2, 2008, 11:33 AM UTC

Good Morning Laura,

My bad on OtMoveIt, it was updated to a new version, but lets try something else first.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Killall::

Killall::

Registry::
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AskPBar Uninstall"=-

RenV::
—-a-w 579,072 2008-01-17 09:58:16 C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w 219,136 2008-01-17 10:03:04 C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w 5,674,352 2008-01-17 09:58:46 C:\Program Files\MSN Messenger\MsnMsgr .Exe

gizmo161uk

Post #9February 2, 2008, 6:51 PM UTC

Here are the requested logs

================================================================================

ComboFix

ComboFix 08-01-30.6 - User 2008-02-02 16:27:40.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-02 to 2008-02-02 )))))))))))))))))))))))))))))))
.

2008-01-31 02:22 . 2008-01-26 18:07 241,664 –a—— C:\Program Files\Uninstall Ask Toolbar.dll
2008-01-30 17:43 . 2008-01-30 17:43 d——– C:\VundoFix Backups
2008-01-28 10:21 . 2008-01-28 10:21 7,680 –ahs—- C:\WINDOWS\Thumbs.db
2008-01-27 01:44 . 2008-01-27 01:44 d——– C:\Documents and Settings\User\Application Data\Jasc Software Inc
2008-01-26 18:07 . 2008-01-26 18:45 d——– C:\Program Files\The Weather Channel FW
2008-01-26 18:04 . 2008-01-26 18:17 d——– C:\Program Files\Trillian
2008-01-26 06:06 . 2008-01-26 06:06 d——– C:\Documents and Settings\User\Application Data\Sonic
2008-01-25 19:37 . 2008-01-25 19:37 d——– C:\Documents and Settings\User\Application Data\Ulead Systems
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\WINDOWS\system32\ws073247.ocx
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\os357577.bin
2008-01-25 19:35 . 2008-01-25 19:35 d——– C:\WINDOWS\Vbox
2008-01-25 19:34 . 2008-01-25 19:34 d——– C:\Program Files\Ulead Systems
2008-01-25 19:34 . 2008-01-25 19:36 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-01-25 19:33 . 2008-01-25 19:33 d——– C:\WINDOWS\Noslip
2008-01-20 11:50 . 2005-01-31 10:04 2,180,096 –a—— C:\WINDOWS\system32\drivers\lvsvf2.sys
2008-01-19 07:34 . 2008-02-02 16:33 11,434,016 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-19 07:34 . 2008-02-02 16:33 131,180 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-18 22:38 . 2008-01-26 05:56 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 22:36 . 2008-01-24 09:14 d——– C:\Program Files\Spyware Doctor
2008-01-18 22:36 . 2008-01-18 22:36 d——– C:\Documents and Settings\User\Application Data\PC Tools
2008-01-18 22:36 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-18 22:36 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-18 22:36 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-18 22:36 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 22:35 . 2008-01-18 22:35 d——– C:\Program Files\ZoneAlarmSB
2008-01-18 22:29 . 2008-01-18 22:29 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-18 22:28 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-18 22:28 . 2008-01-18 22:36 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-01-18 22:27 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-01-18 22:23 . 2008-01-18 22:28 d——– C:\WINDOWS\system32\ZoneLabs
2008-01-18 22:23 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-01-18 22:23 . 2008-02-02 16:34 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-01-18 22:21 . 2008-02-02 16:12 d——– C:\WINDOWS\Internet Logs
2008-01-18 22:16 . 2008-02-02 08:00 d——– C:\Documents and Settings\User\Application Data\AVG7
2008-01-18 22:15 . 2008-01-18 22:15 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-18 22:14 . 2008-01-18 22:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-18 20:17 . 2008-01-18 20:23 d——– C:\Program Files\RegistryFix
2008-01-18 13:40 . 2008-01-18 13:40 d——– C:\Documents and Settings\User\Application Data\Grisoft
2008-01-18 13:39 . 2007-05-30 12:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-18 10:59 . 2008-01-18 10:59 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-18 10:58 . 2008-01-18 17:38 d——– C:\Program Files\The Cleaner Free
2008-01-17 14:23 . 2002-03-13 08:50 23,296 –a—— C:\WINDOWS\system32\drivers\NaiFiltr.sys
2008-01-17 13:40 . 2005-08-10 11:22 114,464 –a—— C:\WINDOWS\system32\drivers\naiavf5x.sys
2008-01-17 13:38 . 2008-01-17 13:42 d——– C:\Documents and Settings\All Users\Application Data\MCAD3.tmp
2008-01-17 13:03 . 2008-01-17 13:34 d——– C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-01-17 13:02 . 2005-05-24 19:23 288,320 –a—— C:\WINDOWS\system32\McGDMgr.dll
2008-01-17 13:01 . 2008-01-17 13:04 d——– C:\Program Files\McAfee.com
2008-01-17 13:01 . 2005-10-18 11:08 349,760 –a—— C:\WINDOWS\system32\mcinsctl.dll
2008-01-17 12:41 . 2008-01-17 12:41 d——– C:\Documents and Settings\All Users\Application Data\pcgdemo
2008-01-17 10:43 . 2008-01-18 22:14 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 03:00 . 2008-01-17 03:00 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-17 02:57 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2008-01-17 02:56 . 2005-01-31 10:18 372,736 –a—— C:\WINDOWS\system32\LVUI2RC.dll
2008-01-17 02:56 . 2005-01-31 10:20 211,712 –a—— C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-01-17 02:56 . 2005-01-31 10:10 204,800 –a—— C:\WINDOWS\system32\LVUI2.dll
2008-01-17 02:56 . 2005-01-31 10:08 204,800 –a—— C:\WINDOWS\system32\lvcodec2.dll
2008-01-17 02:56 . 2005-01-31 10:00 106,496 –a—— C:\WINDOWS\system32\lvcoinst.dll
2008-01-17 02:56 . 2005-01-31 10:12 22,016 –a—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-01-17 02:56 . 2005-01-31 08:37 9,255 –a—— C:\WINDOWS\system32\lvcoinst.ini
2008-01-17 02:49 . 2008-01-17 02:49 81,920 -r——- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-16 12:53 . 2008-01-18 17:54 d——– C:\Program Files\MSN Messenger
2008-01-16 12:37 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-16 12:37 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-16 12:37 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 08:16 . 2008-01-16 08:25 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-16 08:15 . 2008-01-18 17:52 d——– C:\Program Files\Windows Live
2008-01-16 08:14 . 2008-01-17 10:52 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a–c— C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a–c— C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a–c— C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2008-01-13 04:01 . 2008-01-17 02:56 d——– C:\Program Files\Common Files\Logitech
2008-01-13 03:59 . 2008-01-17 02:31 d——– C:\Program Files\Common Files\LogiShrd
2008-01-13 03:57 . 2008-01-17 02:49 d——– C:\Program Files\Logitech
2008-01-11 21:55 . 2004-05-14 16:53 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2008-01-11 21:55 . 2004-01-12 02:09 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2008-01-11 21:55 . 2003-11-04 15:10 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2008-01-10 17:43 . 2006-11-22 21:11 135,168 -ra—— C:\WINDOWS\UNDPX2A.exe
2008-01-10 17:43 . 2006-11-22 21:11 53,693 -ra—— C:\WINDOWS\UNDPX2A.sys
2008-01-10 17:43 . 2006-11-22 21:11 15,429 -ra—— C:\WINDOWS\system32\drivers\Sacm2A.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-29 09:23 3,417,600 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-29 09:22 1,411,072 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 01:44 ——— d—–w C:\Program Files\Jasc Software Inc
2008-01-26 12:45 ——— d—–w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-01-25 19:34 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 11:26 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-19 10:32 ——— d—–w C:\Program Files\Ares
2008-01-16 03:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 09:07 ——— d—–w C:\Program Files\Plugin Commander Light
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-22 06:01 56 –sha-r C:\WINDOWS\system32\36375C4983.sys
2007-10-22 06:01 1,682 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

—-a-w		   579,072 2008-01-17 09:58:16  C:\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   219,136 2008-01-17 10:03:04  C:\Program Files\Grisoft\AVG7\avgw .exe
—-a-w		 5,674,352 2008-01-17 09:58:46  C:\Program Files\MSN Messenger\MsnMsgr .Exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-18 22:36 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BA52B914-B692-46C4-B683-905236F6F655}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-18 22:36 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 21:54 961536]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPSMain"="TPSMain.exe" [2006-02-08 14:02 266240 C:\WINDOWS\system32\TPSMain.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-20 11:23 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-18 22:14 219136]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F062886D-33B5-D25E-7167-F0D10E66C0D5}]
C:\WINDOWS\system32:dllhosts.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 16:35:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Trillian\trillian.exe
.
**************************************************************************
.
Completion time: 2008-02-02 18:40:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-02 18:40:10
ComboFix2.txt 2008-01-31 03:28:49
ComboFix3.txt 2008-01-30 19:23:34
.
2008-01-20 11:26:50 — E O F —

================================================================================

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:47:27, on 02/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8336 bytes

ken545

Post #10February 2, 2008, 11:50 PM UTC

Hi,

Those infected files did not go, lets run them through OtMoveIt, this is the new version.

Please download OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Uninstall Ask Toolbar.dll
C:\Program Files\Grisoft\AVG7\avgcc .exe
C:\Program Files\Grisoft\AVG7\avgw .exe
C:\Program Files\MSN Messenger\MsnMsgr .Exe
Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Then delete the copy of Combofix you have and grab a fresh copy and run Combofix again please.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

I just need to see the OtMoveIt log and the New Combofix log

gizmo161uk

Post #11February 4, 2008, 12:02 AM UTC

Would it be any easier to simply put the laptop back to factory settings? I ordered the reboot disc from the manufactorers which came yesterday, would it be easier to just use that?

Here are the requested logs

================================================================================

OTMoveIt log

[Custom Input]
< C:\Program Files\Uninstall Ask Toolbar.dll >
File/Folder C:\Program Files\Uninstall Ask Toolbar.dll not found.
< C:\Program Files\Grisoft\AVG7\avgcc .exe >
C:\Program Files\Grisoft\AVG7\avgcc .exe moved successfully.
< C:\Program Files\Grisoft\AVG7\avgw .exe >
C:\Program Files\Grisoft\AVG7\avgw .exe moved successfully.
< C:\Program Files\MSN Messenger\MsnMsgr .Exe >
C:\Program Files\MSN Messenger\MsnMsgr .Exe moved successfully.

OTMoveIt2 v1.0.17 log created on 02032008_232420

================================================================================

ComboFix Log

ComboFix 08-02.03.1 - User 2008-02-03 23:28:59.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-03 23:24 . 2008-02-03 23:24 d——– C:\_OTMoveIt
2008-01-30 17:43 . 2008-01-30 17:43 d——– C:\VundoFix Backups
2008-01-28 10:21 . 2008-01-28 10:21 7,680 –ahs—- C:\WINDOWS\Thumbs.db
2008-01-27 01:44 . 2008-01-27 01:44 d——– C:\Documents and Settings\User\Application Data\Jasc Software Inc
2008-01-26 18:07 . 2008-01-26 18:45 d——– C:\Program Files\The Weather Channel FW
2008-01-26 18:04 . 2008-02-02 18:43 d——– C:\Program Files\Trillian
2008-01-26 06:06 . 2008-01-26 06:06 d——– C:\Documents and Settings\User\Application Data\Sonic
2008-01-25 19:37 . 2008-01-25 19:37 d——– C:\Documents and Settings\User\Application Data\Ulead Systems
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\WINDOWS\system32\ws073247.ocx
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\os357577.bin
2008-01-25 19:35 . 2008-01-25 19:35 d——– C:\WINDOWS\Vbox
2008-01-25 19:34 . 2008-01-25 19:34 d——– C:\Program Files\Ulead Systems
2008-01-25 19:34 . 2008-01-25 19:36 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-01-25 19:33 . 2008-01-25 19:33 d——– C:\WINDOWS\Noslip
2008-01-20 11:50 . 2005-01-31 10:04 2,180,096 –a—— C:\WINDOWS\system32\drivers\lvsvf2.sys
2008-01-19 07:34 . 2008-02-03 19:45 11,657,248 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-19 07:34 . 2008-02-02 16:33 131,180 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-18 22:38 . 2008-01-26 05:56 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 22:36 . 2008-01-24 09:14 d——– C:\Program Files\Spyware Doctor
2008-01-18 22:36 . 2008-01-18 22:36 d——– C:\Documents and Settings\User\Application Data\PC Tools
2008-01-18 22:36 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-18 22:36 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-18 22:36 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-18 22:36 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 22:35 . 2008-01-18 22:35 d——– C:\Program Files\ZoneAlarmSB
2008-01-18 22:29 . 2008-01-18 22:29 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-18 22:28 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-18 22:28 . 2008-01-18 22:36 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-01-18 22:27 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-01-18 22:23 . 2008-01-18 22:28 d——– C:\WINDOWS\system32\ZoneLabs
2008-01-18 22:23 . 2008-01-18 22:23 d——– C:\Program Files\Zone Labs
2008-01-18 22:23 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-01-18 22:23 . 2008-02-03 19:54 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-01-18 22:21 . 2008-02-03 19:52 d——– C:\WINDOWS\Internet Logs
2008-01-18 22:16 . 2008-02-03 08:00 d——– C:\Documents and Settings\User\Application Data\AVG7
2008-01-18 22:15 . 2008-01-18 22:15 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-18 22:14 . 2008-01-18 22:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-18 20:17 . 2008-01-18 20:23 d——– C:\Program Files\RegistryFix
2008-01-18 13:40 . 2008-01-18 13:40 d——– C:\Documents and Settings\User\Application Data\Grisoft
2008-01-18 13:39 . 2007-05-30 12:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-18 10:59 . 2008-01-18 10:59 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-18 10:58 . 2008-01-18 17:38 d——– C:\Program Files\The Cleaner Free
2008-01-17 14:23 . 2002-03-13 08:50 23,296 –a—— C:\WINDOWS\system32\drivers\NaiFiltr.sys
2008-01-17 13:40 . 2005-08-10 11:22 114,464 –a—— C:\WINDOWS\system32\drivers\naiavf5x.sys
2008-01-17 13:38 . 2008-01-17 13:42 d——– C:\Documents and Settings\All Users\Application Data\MCAD3.tmp
2008-01-17 13:03 . 2008-01-17 13:34 d——– C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-01-17 13:02 . 2005-05-24 19:23 288,320 –a—— C:\WINDOWS\system32\McGDMgr.dll
2008-01-17 13:01 . 2008-01-17 13:04 d——– C:\Program Files\McAfee.com
2008-01-17 13:01 . 2005-10-18 11:08 349,760 –a—— C:\WINDOWS\system32\mcinsctl.dll
2008-01-17 12:41 . 2008-01-17 12:41 d——– C:\Documents and Settings\All Users\Application Data\pcgdemo
2008-01-17 10:43 . 2008-01-18 22:14 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 03:00 . 2008-01-17 03:00 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-17 02:57 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2008-01-17 02:56 . 2005-01-31 10:18 372,736 –a—— C:\WINDOWS\system32\LVUI2RC.dll
2008-01-17 02:56 . 2005-01-31 10:20 211,712 –a—— C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-01-17 02:56 . 2005-01-31 10:10 204,800 –a—— C:\WINDOWS\system32\LVUI2.dll
2008-01-17 02:56 . 2005-01-31 10:08 204,800 –a—— C:\WINDOWS\system32\lvcodec2.dll
2008-01-17 02:56 . 2005-01-31 10:00 106,496 –a—— C:\WINDOWS\system32\lvcoinst.dll
2008-01-17 02:56 . 2005-01-31 10:12 22,016 –a—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-01-17 02:56 . 2005-01-31 08:37 9,255 –a—— C:\WINDOWS\system32\lvcoinst.ini
2008-01-17 02:49 . 2008-01-17 02:49 81,920 -r——- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-16 12:53 . 2008-02-03 23:24 d——– C:\Program Files\MSN Messenger
2008-01-16 12:37 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-16 12:37 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-16 12:37 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 08:16 . 2008-01-16 08:25 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-16 08:15 . 2008-01-18 17:52 d——– C:\Program Files\Windows Live
2008-01-16 08:14 . 2008-01-17 10:52 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a–c— C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a–c— C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a–c— C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2008-01-13 04:01 . 2008-01-17 02:56 d——– C:\Program Files\Common Files\Logitech
2008-01-13 03:59 . 2008-01-17 02:31 d——– C:\Program Files\Common Files\LogiShrd
2008-01-13 03:57 . 2008-01-17 02:49 d——– C:\Program Files\Logitech
2008-01-11 21:55 . 2004-05-14 16:53 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2008-01-11 21:55 . 2004-01-12 02:09 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2008-01-11 21:55 . 2003-11-04 15:10 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2008-01-10 17:43 . 2006-11-22 21:11 135,168 -ra—— C:\WINDOWS\UNDPX2A.exe
2008-01-10 17:43 . 2006-11-22 21:11 53,693 -ra—— C:\WINDOWS\UNDPX2A.sys
2008-01-10 17:43 . 2006-11-22 21:11 15,429 -ra—— C:\WINDOWS\system32\drivers\Sacm2A.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 19:51 2,935,296 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-29 09:23 3,417,600 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-29 09:22 1,411,072 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 01:44 ——— d—–w C:\Program Files\Jasc Software Inc
2008-01-26 12:45 ——— d—–w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-01-25 19:34 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 11:26 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-19 10:32 ——— d—–w C:\Program Files\Ares
2008-01-16 03:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 09:07 ——— d—–w C:\Program Files\Plugin Commander Light
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-22 06:01 56 –sha-r C:\WINDOWS\system32\36375C4983.sys
2007-10-22 06:01 1,682 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

—-a-w		   579,072 2008-01-17 09:58:16  C:\_OTMoveIt\MovedFiles\02032008_232420\Program Files\Grisoft\AVG7\avgcc .exe
—-a-w		   219,136 2008-01-17 10:03:04  C:\_OTMoveIt\MovedFiles\02032008_232420\Program Files\Grisoft\AVG7\avgw .exe
—-a-w		 5,674,352 2008-01-17 09:58:46  C:\_OTMoveIt\MovedFiles\02032008_232420\Program Files\MSN Messenger\MsnMsgr .Exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-18 22:36 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BA52B914-B692-46C4-B683-905236F6F655}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-18 22:36 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 21:54 961536]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPSMain"="TPSMain.exe" [2006-02-08 14:02 266240 C:\WINDOWS\system32\TPSMain.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-20 11:23 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-18 22:14 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-01-17 02:49:34 450560]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-12-03 11:10:00 394856]

R3 BoiHwsetup;Access 32bits INT15 routine;C:\WINDOWS\system32\drivers\BoiHwSetup.sys [2005-06-11 04:42]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-11-29 21:50]
R3 qkbfiltr;Quanta HotKey Keyboard Filter Driver;C:\WINDOWS\system32\drivers\qkbfiltr.sys [2006-01-12 15:21]
R3 qmofiltr;Quanta HotKey Mouse Filter Driver;C:\WINDOWS\system32\drivers\qmofiltr.sys [2005-05-05 13:27]
S3 MS1000;MS1000;C:\WINDOWS\system32\DRIVERS\MS1000.sys [2008-01-18 10:59]
S3 WLAN(WLAN);802.11b+g USB Wireless LAN Adapter Driver(WLAN);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-08-06 11:54]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F062886D-33B5-D25E-7167-F0D10E66C0D5}]
C:\WINDOWS\system32:dllhosts.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 23:34:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 23:36:37
ComboFix-quarantined-files.txt 2008-02-03 23:36:29
ComboFix2.txt 2008-02-02 18:40:21
ComboFix3.txt 2008-01-31 03:28:49
ComboFix4.txt 2008-01-30 19:23:34
.
2008-01-20 11:26:50 — E O F —

ken545

Post #12February 4, 2008, 12:24 AM UTC

You can if you like, but try this first.

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Then grab a fresh copy of Combofix and I am sure they will be gone.

Download ComboFix from Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

gizmo161uk

Post #13February 5, 2008, 3:54 AM UTC

here are the requested log files.

================================================================================

ComboFix

ComboFix 08-02.05.3 - User 2008-02-05 3:15:03.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))))))))
.

2008-01-28 10:21 . 2008-01-28 10:21 7,680 –ahs—- C:\WINDOWS\Thumbs.db
2008-01-27 01:44 . 2008-01-27 01:44 d——– C:\Documents and Settings\User\Application Data\Jasc Software Inc
2008-01-26 18:07 . 2008-01-26 18:45 d——– C:\Program Files\The Weather Channel FW
2008-01-26 18:04 . 2008-02-02 18:43 d——– C:\Program Files\Trillian
2008-01-26 06:06 . 2008-01-26 06:06 d——– C:\Documents and Settings\User\Application Data\Sonic
2008-01-25 19:37 . 2008-01-25 19:37 d——– C:\Documents and Settings\User\Application Data\Ulead Systems
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\WINDOWS\system32\ws073247.ocx
2008-01-25 19:37 . 2008-01-25 21:17 562 –ah—– C:\os357577.bin
2008-01-25 19:35 . 2008-01-25 19:35 d——– C:\WINDOWS\Vbox
2008-01-25 19:34 . 2008-01-25 19:34 d——– C:\Program Files\Ulead Systems
2008-01-25 19:34 . 2008-01-25 19:36 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-01-25 19:33 . 2008-01-25 19:33 d——– C:\WINDOWS\Noslip
2008-01-20 11:50 . 2005-01-31 10:04 2,180,096 –a—— C:\WINDOWS\system32\drivers\lvsvf2.sys
2008-01-19 07:34 . 2008-02-05 03:20 11,667,488 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-19 07:34 . 2008-02-03 23:53 131,780 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-18 22:38 . 2008-01-26 05:56 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-18 22:36 . 2008-01-24 09:14 d——– C:\Program Files\Spyware Doctor
2008-01-18 22:36 . 2008-01-18 22:36 d——– C:\Documents and Settings\User\Application Data\PC Tools
2008-01-18 22:36 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-18 22:36 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-18 22:36 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-18 22:36 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 22:35 . 2008-01-18 22:35 d——– C:\Program Files\ZoneAlarmSB
2008-01-18 22:29 . 2008-01-18 22:29 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-18 22:28 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-18 22:28 . 2008-01-18 22:36 4,212 –ah—– C:\WINDOWS\system32\zllictbl.dat
2008-01-18 22:27 . 2004-04-27 04:40 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2008-01-18 22:23 . 2008-01-18 22:28 d——– C:\WINDOWS\system32\ZoneLabs
2008-01-18 22:23 . 2008-01-18 22:23 d——– C:\Program Files\Zone Labs
2008-01-18 22:23 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2008-01-18 22:23 . 2008-02-03 23:56 353,366 –a—— C:\WINDOWS\system32\vsconfig.xml
2008-01-18 22:21 . 2008-02-04 17:32 d——– C:\WINDOWS\Internet Logs
2008-01-18 22:16 . 2008-02-04 08:00 d——– C:\Documents and Settings\User\Application Data\AVG7
2008-01-18 22:15 . 2008-01-18 22:15 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-18 22:14 . 2008-01-18 22:19 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-01-18 20:17 . 2008-01-18 20:23 d——– C:\Program Files\RegistryFix
2008-01-18 13:40 . 2008-01-18 13:40 d——– C:\Documents and Settings\User\Application Data\Grisoft
2008-01-18 13:39 . 2007-05-30 12:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-18 10:59 . 2008-01-18 10:59 5,376 –a—— C:\WINDOWS\system32\drivers\MS1000.sys
2008-01-18 10:58 . 2008-01-18 17:38 d——– C:\Program Files\The Cleaner Free
2008-01-17 14:23 . 2002-03-13 08:50 23,296 –a—— C:\WINDOWS\system32\drivers\NaiFiltr.sys
2008-01-17 13:40 . 2005-08-10 11:22 114,464 –a—— C:\WINDOWS\system32\drivers\naiavf5x.sys
2008-01-17 13:38 . 2008-01-17 13:42 d——– C:\Documents and Settings\All Users\Application Data\MCAD3.tmp
2008-01-17 13:03 . 2008-01-17 13:34 d——– C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-01-17 13:02 . 2005-05-24 19:23 288,320 –a—— C:\WINDOWS\system32\McGDMgr.dll
2008-01-17 13:01 . 2008-01-17 13:04 d——– C:\Program Files\McAfee.com
2008-01-17 13:01 . 2005-10-18 11:08 349,760 –a—— C:\WINDOWS\system32\mcinsctl.dll
2008-01-17 12:41 . 2008-01-17 12:41 d——– C:\Documents and Settings\All Users\Application Data\pcgdemo
2008-01-17 10:43 . 2008-01-18 22:14 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-17 03:00 . 2008-01-17 03:00 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-17 02:57 . 2004-10-08 12:46 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2008-01-17 02:56 . 2005-01-31 10:18 372,736 –a—— C:\WINDOWS\system32\LVUI2RC.dll
2008-01-17 02:56 . 2005-01-31 10:20 211,712 –a—— C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-01-17 02:56 . 2005-01-31 10:10 204,800 –a—— C:\WINDOWS\system32\LVUI2.dll
2008-01-17 02:56 . 2005-01-31 10:08 204,800 –a—— C:\WINDOWS\system32\lvcodec2.dll
2008-01-17 02:56 . 2005-01-31 10:00 106,496 –a—— C:\WINDOWS\system32\lvcoinst.dll
2008-01-17 02:56 . 2005-01-31 10:12 22,016 –a—— C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-01-17 02:56 . 2005-01-31 08:37 9,255 –a—— C:\WINDOWS\system32\lvcoinst.ini
2008-01-17 02:49 . 2008-01-17 02:49 81,920 -r——- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-01-16 12:53 . 2008-02-03 23:24 d——– C:\Program Files\MSN Messenger
2008-01-16 12:37 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-01-16 12:37 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-01-16 12:37 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 08:16 . 2008-01-16 08:25 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-16 08:15 . 2008-01-18 17:52 d——– C:\Program Files\Windows Live
2008-01-16 08:14 . 2008-01-17 10:52 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a—— C:\WINDOWS\system32\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 90,624 –a–c— C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a—— C:\WINDOWS\system32\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 61,952 –a–c— C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a—— C:\WINDOWS\system32\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 53,760 –a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a—— C:\WINDOWS\system32\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 43,008 –a–c— C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a—— C:\WINDOWS\system32\vidcap.ax
2008-01-14 19:41 . 2004-08-04 00:56 28,672 –a–c— C:\WINDOWS\system32\dllcache\vidcap.ax
2008-01-13 04:01 . 2008-01-17 02:56 d——– C:\Program Files\Common Files\Logitech
2008-01-13 03:59 . 2008-01-17 02:31 d——– C:\Program Files\Common Files\LogiShrd
2008-01-13 03:57 . 2008-01-17 02:49 d——– C:\Program Files\Logitech
2008-01-11 21:55 . 2004-05-14 16:53 462,848 –a—— C:\WINDOWS\system32\ltkrn13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 450,560 –a—— C:\WINDOWS\system32\ltimg13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 401,408 –a—— C:\WINDOWS\system32\lfcmp13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 299,008 –a—— C:\WINDOWS\system32\ltdis13n.dll
2008-01-11 21:55 . 2004-01-12 02:09 206,336 –a—— C:\WINDOWS\system32\ltefx13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 163,840 –a—— C:\WINDOWS\system32\ltfil13n.dll
2008-01-11 21:55 . 2003-11-04 15:10 69,632 –a—— C:\WINDOWS\system32\lfgif13n.dll
2008-01-11 21:55 . 2004-05-14 16:53 57,344 –a—— C:\WINDOWS\system32\lfbmp13n.dll
2008-01-10 17:43 . 2006-11-22 21:11 135,168 -ra—— C:\WINDOWS\UNDPX2A.exe
2008-01-10 17:43 . 2006-11-22 21:11 53,693 -ra—— C:\WINDOWS\UNDPX2A.sys
2008-01-10 17:43 . 2006-11-22 21:11 15,429 -ra—— C:\WINDOWS\system32\drivers\Sacm2A.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 23:54 1,000,138 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-02-03 19:51 2,935,296 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-29 09:23 3,417,600 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-29 09:22 1,411,072 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-27 01:44 ——— d—–w C:\Program Files\Jasc Software Inc
2008-01-26 12:45 ——— d—–w C:\Documents and Settings\User\Application Data\OpenOffice.org2
2008-01-25 19:34 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 11:26 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-19 10:32 ——— d—–w C:\Program Files\Ares
2008-01-16 03:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-26 09:07 ——— d—–w C:\Program Files\Plugin Commander Light
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-22 06:01 56 –sha-r C:\WINDOWS\system32\36375C4983.sys
2007-10-22 06:01 1,682 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-18 22:36 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{BA52B914-B692-46C4-B683-905236F6F655}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-18 22:36 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-07-16 21:54 961536]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPSMain"="TPSMain.exe" [2006-02-08 14:02 266240 C:\WINDOWS\system32\TPSMain.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-20 11:23 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-18 22:14 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F062886D-33B5-D25E-7167-F0D10E66C0D5}]
C:\WINDOWS\system32:dllhosts.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 03:21:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-05 3:25:21
ComboFix2.txt 2008-02-03 23:36:38
.
2008-01-20 11:26:50 — E O F —

================================================================================

HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:26:57, on 05/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\kmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8519 bytes

ken545

Post #14February 5, 2008, 10:21 AM UTC last edited February 5, 2008, 11:20 AM UTC

Good Morning,

It looks like the Vundo infection is gone but your logs have markers in them for a Rootkit

Would it be any easier to simply put the laptop back to factory settings? I ordered the reboot disc from the manufactorers which came yesterday, would it be easier to just use that?

You have had a nasty infection on this computer and still do in the form of a Rootkit, I saw that present from the start but wanted to do one thing at a time. All the programs that Combofix found in the codebox where infected by the Vundo trojan, if they will still run properly after we are done remains to be seen. You may have to uninstall and reinstall all those programs. The Rootkit is another serious threat. I think at this point if this was my computer I would go ahead and reset it back to factory defaults. The hard drive will have be wiped clean or you will just be reinstalling over this damage. Its your call but if you want to proceed than run this program.

Download haxfix.exe
and save it to your desktop.

Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon"
Click "Next"
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
Click "Finish"

A red "dos window" (dos box) will open with options:
1. Make logfile
2. Run auto fix
3. Run manual fix
E. Exit Haxfix

Select option 1. Make logfile by typing 1 and then pressing Enter
Haxfix will start scanning the computer. When it is finished a logfile will open: haxlog.txt
Copy the contents of that logfile and paste it into this thread. (c:\haxfix.txt)

gizmo161uk

Post #15February 6, 2008, 5:39 PM UTC

You have had a nasty infection on this computer and still do in the form of a Rootkit, I saw that present from the start but wanted to do one thing at a time. All the programs that Combofix found in the codebox where infected by the Vundo trojan, if they will still run properly after we are done remains to be seen. You may have to uninstall and reinstall all those programs. The Rootkit is another serious threat. I think at this point if this was my computer I would go ahead and reset it back to factory defaults. The hard drive will have be wiped clean or you will just be reinstalling over this damage. Its your call but if you want to proceed than run this program.

Thank you so much Ken for all of your help, If I have any compuer problems in the future I'll be sure to come here first!! After showing my fiancee your last reply we've decided to follow what you said you wuld do if it was your computer and restore it to factory settings.

Again Thank you for all your help, and I will be recomending your site in the future!!

Laura
x

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] my hijack this log

✨ Ask AI

Ask AI